IT Security Takeaways from the Wiseasy Hack

Last month Tech Crunch reported that payment terminal manufacturer Wiseasy had
been hacked^[1]. Although Wiseasy might
not be well known in North America, their Android-based payment
terminals are widely used in the Asia Pacific region and hackers
managed to steal passwords for 140,000 payment terminals.

How Did the Wiseasy Hack Happen?

Wiseasy employees use a cloud-based dashboard for remotely
managing payment terminals. This dashboard allows the company to
perform a variety of configuration and management tasks such as
managing payment terminal users, adding or removing apps, and even
locking the terminal.

Hackers were able to gain access to the Wiseasy dashboard by
infecting employee’s computers with malware. This allowed hackers
to gain access to two different employee’s dashboards, ultimately
leading to a massive harvesting of payment terminal credentials
once they gained access.

Top Lessons Learned from the Wiseasy Hack

1 — Transparency isn’t always the best policy

While it is easy to simply dismiss the Wiseasy hack as stemming
from an unavoidable malware infection, the truth is that Wiseasy
made several mistakes (according to the Tech Crunch article) that
allowed the hack to succeed.

For example, the dashboard itself likely exposed more
information than it should have. According to Tech Crunch^[2], the dashboard “allowed
anyone to view names, phone numbers, email addresses, and access
permissions”. Although the case could be made that such information
is necessary for Wiseasy to manage terminals on their customers’
behalf, Tech Crunch goes on to say that a dashboard view revealed
the Wi-Fi name and plain text password for the network that the
payment terminal was connected to.

In a standard security environment, interface should never be
designed to display passwords. The open display of customer
information, without a secondary verification of the end-user, also
goes against a zero-trust policy.

2 — Credentials alone won’t cut it

A second mistake that likely helped the hack to succeed was that
Wiseasy did not require multifactor authentication to be used when
accessing the dashboard. In the past, most systems were protected
solely by authentication credentials. This meant that anyone with
access to a valid username and password could log in, even if the
credentials were stolen (as was the case in the Wiseasy hack).

Multifactor authentication requires users to use an additional
mechanism to prove their identity prior to accessing sensitive
resources. Often this means providing a code that was sent to the
user’s smartphone by SMS text message, but there are many other
forms of multifactor authentication. In any case, Wiseasy did not
use multifactor authentication, there was nothing stopping hackers
from logging in using stolen credentials.

3 — Devices should be triple checked

A possible third mistake might have been that of Wiseasy
employees accessing sensitive resources from a non-hardened device.
Tech Crunch reported seeing screen captures of the Wiseasy
dashboard in which an admin user had remote access to payment
terminals. The Tech Crunch article does not say that the admin’s
computer had been infected with malware, but since malware was used
to gain access to the dashboard and the screen capture shows an
admin logged into the dashboard, it is entirely possible that an
admin’s machine was compromised.

As a best practice, privileged accounts should only be used when
required for a particular task (with standard accounts being used
at other times). Additionally, privileged accounts should ideally
be used only on designated management systems that have been
hardened and are not used for any other tasks.

4 — Stay on top of your own security

Finally, the biggest mistake made in the Wiseasy hack was that
the company seemingly (based on the Tech Crunch article) did not
know that its accounts had been compromised until they were
contacted by Buguard.

Buguard is a security company specializing in pen testing and
dark web monitoring. Ideally, Wiseasy would be monitoring their own
network for a potential breach and shut it down immediately when
it’s first noticed.

Moving Forward: How to protect your own network from a similar
hack

The Wiseasy hack underscores the importance of adhering to long
established security best practices such as requiring multifactor
authentication and using dedicated management workstations for
privileged operations. Subscribing to a zero-trust
philosophy^[3] in your organization can
solve a lot of these problems.

Additionally, it’s important to have a way of knowing if your
organization’s accounts have been compromised. Otherwise, an
attacker who has gained access to stolen account credentials could
use those credentials indefinitely. One of the best ways to keep
this from happening is to use Specops Password Policy^[4]. Specops maintains a
database of billions of passwords that are known to have been
compromised.

This database is kept up to date with passwords found on known
breached password lists, as well as passwords being actively used
in attacks. Specops Password Policy uses this information to make
sure that none of your user’s passwords have been compromised. If
an account is found to be using a compromised password, the
software will notify you so that you can disable the account or
change its password right away. You can test out Specops Password Policy tools in
your AD for free, anytime^[5].

Whether you’re bringing pen testing in house, moving toward a
zero-trust infrastructure, or blocking known breached passwords
from your Active Directory, there are a lot of ways to make sure
your organization doesn’t fall victim to the consequences of a
malware attack like Wiseasy.